@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/packages/interchange/defensive-indicator-export.mjs

@@ -0,0 +1,264 @@
+// Pure defensive-domain export formatting for filtered Bulk findings. These
+// files are generated locally and never submitted or applied automatically.
+import { caseDispositionSupportsDefensiveResponse } from "../cases/case-record-decisions.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { DEFENSIVE_INDICATOR_EXPORT_VERSION, DEFENSIVE_INDICATOR_MANIFEST_SCHEMA, DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA, } from "../contracts/analyst-interchange.mjs";
+export { DEFENSIVE_INDICATOR_EXPORT_VERSION, DEFENSIVE_INDICATOR_MANIFEST_SCHEMA, DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA, } from "../contracts/analyst-interchange.mjs";
+export const MAX_DEFENSIVE_INDICATORS = 2000;
+export const MAX_DEFENSIVE_INDICATOR_INPUTS = MAX_DEFENSIVE_INDICATORS * 4;
+export const DEFENSIVE_INDICATOR_FORMATS = Object.freeze(['domains', 'hosts', 'dnsmasq', 'rpz']);
+const REGISTERED_STATES = new Set(['registered', 'for_sale', 'expiring']);
+const MINIMUM_RISK_SCORE = 70;
+const CONTROL_RE = /[\x00-\x1f\x7f]/;
+function plainRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function riskScore(record) {
+    const value = record.risk ?? record.riskScore;
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+/** Source metadata shared by interchange writers; export time is not evidence time. */
+export function defensiveIndicatorProvenance(value) {
+    const source = plainRecord(value) ?? {};
+    const saved = plainRecord(source.saved) ?? {};
+    const score = riskScore(source);
+    const version = source.riskModelVersion ?? saved.riskModelVersion;
+    const depth = source.scanDepth ?? saved.scanDepth;
+    return Object.freeze({
+        riskScore: score === null ? null : Math.max(0, Math.min(100, Math.round(score))),
+        riskModelVersion: typeof version === 'number' && Number.isSafeInteger(version) && version > 0 && version <= 1_000 ? version : null,
+        scanDepth: depth === 'fast' || depth === 'deep' ? depth : 'unknown',
+        observedAt: normalizeExplicitIsoTimestamp(source.observedAt) || normalizeExplicitIsoTimestamp(saved.observedAt),
+    });
+}
+function normalizedDomainSet(value) {
+    if (!Array.isArray(value))
+        return new Set();
+    return new Set(value.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)
+        .map((item) => normalizeDomain(item))
+        .filter((item) => Boolean(item)));
+}
+function analystDisposition(record) {
+    return typeof record.analystDisposition === 'string'
+        ? record.analystDisposition
+        : typeof record.disposition === 'string'
+            ? record.disposition
+            : '';
+}
+function hasReadyProfileContext(record) {
+    const saved = plainRecord(record.saved);
+    const profileContext = plainRecord(saved?.profileContext ?? record.profileContext);
+    return profileContext?.sourceState === 'ready';
+}
+export function isDefensiveIndicatorCandidate(value) {
+    const record = plainRecord(value);
+    if (!record
+        || !hasReadyProfileContext(record)
+        || record.trusted
+        || record.status === 'error'
+        || typeof record.availability !== 'string'
+        || !REGISTERED_STATES.has(record.availability))
+        return false;
+    return Boolean(normalizeDomain(record.domain)) && (riskScore(record) ?? -1) >= MINIMUM_RISK_SCORE;
+}
+export function collectDefensiveIndicatorCandidates(records, limit = MAX_DEFENSIVE_INDICATORS) {
+    if (!Array.isArray(records))
+        throw new TypeError('Defensive indicator export requires an array of Bulk results.');
+    const retainedLimit = Number.isSafeInteger(limit) && limit > 0
+        ? Math.min(limit, MAX_DEFENSIVE_INDICATORS)
+        : MAX_DEFENSIVE_INDICATORS;
+    const byDomain = new Map();
+    for (const item of records.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)) {
+        if (!isDefensiveIndicatorCandidate(item))
+            continue;
+        const record = plainRecord(item);
+        const domain = normalizeDomain(record?.domain);
+        if (record && domain && !byDomain.has(domain))
+            byDomain.set(domain, record);
+    }
+    const candidates = [...byDomain.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([domain, source]) => ({ domain, source }));
+    const entries = candidates.slice(0, retainedLimit);
+    return {
+        entries,
+        domains: entries.map((entry) => entry.domain),
+        truncated: records.length > MAX_DEFENSIVE_INDICATOR_INPUTS || candidates.length > retainedLimit,
+    };
+}
+export function prepareDefensiveIndicatorExport(records, options = {}, limit = MAX_DEFENSIVE_INDICATORS) {
+    if (!Array.isArray(records))
+        throw new TypeError('Defensive indicator export requires an array of Bulk results.');
+    const explicitSelection = Array.isArray(options.selectedDomains);
+    const selected = normalizedDomainSet(options.selectedDomains);
+    const official = normalizedDomainSet(options.officialDomains);
+    const allowlisted = normalizedDomainSet(options.allowlistedDomains);
+    const common = normalizedDomainSet(options.commonInfrastructureDomains);
+    const retainedLimit = Number.isSafeInteger(limit) && limit > 0
+        ? Math.min(limit, MAX_DEFENSIVE_INDICATORS)
+        : MAX_DEFENSIVE_INDICATORS;
+    const exclusions = [];
+    const seenExclusions = new Set();
+    const accepted = new Map();
+    const exclude = (domain, reason) => {
+        const key = `${domain}\u0000${reason}`;
+        if (!seenExclusions.has(key)) {
+            exclusions.push({ domain, reason });
+            seenExclusions.add(key);
+        }
+    };
+    for (const item of records.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)) {
+        const source = plainRecord(item);
+        const domain = normalizeDomain(source?.domain);
+        if (!source || !domain)
+            continue;
+        if (explicitSelection && !selected.has(domain)) {
+            exclude(domain, 'not_selected');
+            continue;
+        }
+        if (!hasReadyProfileContext(source)) {
+            exclude(domain, 'profile_context_unavailable');
+            continue;
+        }
+        if (official.has(domain)) {
+            exclude(domain, 'official_domain');
+            continue;
+        }
+        if (allowlisted.has(domain)) {
+            exclude(domain, 'allowlisted_domain');
+            continue;
+        }
+        if (common.has(domain) || source.commonInfrastructure === true) {
+            exclude(domain, 'common_infrastructure');
+            continue;
+        }
+        if (!isDefensiveIndicatorCandidate(source)) {
+            exclude(domain, 'not_eligible');
+            continue;
+        }
+        const disposition = analystDisposition(source);
+        if (explicitSelection && !caseDispositionSupportsDefensiveResponse(disposition)) {
+            exclude(domain, 'unreviewed_disposition');
+            continue;
+        }
+        if (!accepted.has(domain))
+            accepted.set(domain, source);
+    }
+    const candidates = [...accepted.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([domain, source]) => ({ domain, source }));
+    const entries = candidates.slice(0, retainedLimit);
+    return {
+        entries,
+        domains: entries.map((entry) => entry.domain),
+        exclusions: exclusions.sort((left, right) => left.domain.localeCompare(right.domain) || left.reason.localeCompare(right.reason)),
+        truncated: records.length > MAX_DEFENSIVE_INDICATOR_INPUTS || candidates.length > retainedLimit,
+        explicitSelection,
+    };
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64 || CONTROL_RE.test(value))
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function header(prefix, generatedAt, count) {
+    return [
+        `${prefix} WHOISleuth defensive domain indicators v${DEFENSIVE_INDICATOR_EXPORT_VERSION}`,
+        `${prefix} Generated ${generatedAt}`,
+        `${prefix} ${count} high-risk registered domain${count === 1 ? '' : 's'}`,
+        `${prefix} Review before use. Heuristic findings can include false positives.`,
+    ];
+}
+function formatDomains(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains].join('\n');
+}
+function formatHosts(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains.map((domain) => `0.0.0.0 ${domain}`)].join('\n');
+}
+function formatDnsmasq(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains.map((domain) => `address=/${domain}/0.0.0.0`)].join('\n');
+}
+function formatRpz(domains, generatedAt, includeWildcards) {
+    const serial = Math.floor(Date.parse(generatedAt) / 1000) >>> 0;
+    return [
+        ...header(';', generatedAt, domains.length),
+        '$TTL 60',
+        `@ IN SOA localhost. root.localhost. (${serial} 60 60 60 60)`,
+        '@ IN NS localhost.',
+        ...domains.flatMap((domain) => [
+            `${domain} CNAME .`,
+            ...(includeWildcards ? [`*.${domain} CNAME .`] : []),
+        ]),
+    ].join('\n');
+}
+function contentFor(format, domains, generatedAt, includeWildcards) {
+    if (format === 'hosts')
+        return formatHosts(domains, generatedAt);
+    if (format === 'dnsmasq')
+        return formatDnsmasq(domains, generatedAt);
+    if (format === 'rpz')
+        return formatRpz(domains, generatedAt, includeWildcards);
+    return formatDomains(domains, generatedAt);
+}
+export function buildDefensiveIndicatorExport(records, options = {}) {
+    const format = (typeof options.format === 'string'
+        && DEFENSIVE_INDICATOR_FORMATS.includes(options.format)) ? options.format : 'domains';
+    const generatedAt = timestamp(options.generatedAt) || new Date().toISOString();
+    const includeWildcards = options.includeWildcards === true;
+    const expiryDays = typeof options.expiryDays === 'number' && Number.isSafeInteger(options.expiryDays)
+        ? Math.max(1, Math.min(365, options.expiryDays))
+        : 30;
+    const collected = prepareDefensiveIndicatorExport(records, options);
+    const expiresAt = new Date(Date.parse(generatedAt) + expiryDays * 86_400_000).toISOString();
+    const manifest = {
+        schema: DEFENSIVE_INDICATOR_MANIFEST_SCHEMA,
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        generatedAt,
+        expiresAt,
+        reviewRequired: true,
+        explicitSelection: collected.explicitSelection,
+        includeWildcards,
+        entries: collected.entries.map(({ domain, source }) => ({
+            domain,
+            disposition: analystDisposition(source) || 'not_recorded',
+            reason: `High-risk registered Bulk finding (risk ${riskScore(source) ?? 'unknown'}).`,
+            source: 'bulk',
+            generatedAt,
+            expiresAt,
+        })),
+        exclusions: collected.exclusions,
+    };
+    const rollback = {
+        schema: DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA,
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        generatedAt,
+        removes: collected.domains.map((domain) => ({
+            domain,
+            includeWildcard: includeWildcards,
+            reason: 'Remove the indicator generated by the paired reviewed manifest.',
+        })),
+    };
+    return {
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        format,
+        generatedAt,
+        expiresAt,
+        domains: collected.domains,
+        entries: collected.entries,
+        exclusions: collected.exclusions,
+        explicitSelection: collected.explicitSelection,
+        includeWildcards,
+        truncated: collected.truncated,
+        filename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.${format === 'rpz' ? 'zone' : 'txt'}`,
+        manifestFilename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.manifest.json`,
+        rollbackFilename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.rollback.json`,
+        mimeType: 'text/plain;charset=utf-8',
+        content: `${contentFor(format, collected.domains, generatedAt, includeWildcards)}\n`,
+        manifestContent: `${JSON.stringify(manifest, null, 2)}\n`,
+        rollbackContent: `${JSON.stringify(rollback, null, 2)}\n`,
+    };
+}

package/packages/interchange/external-findings-import.mjs

@@ -1,9 +1,13 @@
-import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
-import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { openOrCreateCase, updateCase } from "../cases/case-record-operations.mjs";
+import { canonicalRegistrableDomain } from "../analysis/registrable-domain.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
+import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
+import { sha256IdentityHex } from "../evidence/record-identity.mjs";
+import { MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_VALUE_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, normalizeCaseEvidencePins, normalizeCaseSightings, } from "../cases/case-response-model.mjs";
+import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDING_LIMITATIONS, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
 import { hasUnsafeRetainedText } from "./retained-text.mjs";
-export { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, };
+export { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDING_LIMITATIONS, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, };
 export const EXTERNAL_FINDING_CATEGORIES = [
     'certificate',
     'dns',
@@ -83,14 +87,31 @@ function iso(value, label, optional = false) {
 function limitations(value, index) {
     if (value === undefined)
         return [];
-    if (!Array.isArray(value) || value.length > 8) {
-        throw new Error(`Finding ${index + 1} limitations must be an array with no more than 8 entries.`);
+    if (!Array.isArray(value) || value.length > MAX_EXTERNAL_FINDING_LIMITATIONS) {
+        throw new Error(`Finding ${index + 1} limitations must be an array with no more than ${MAX_EXTERNAL_FINDING_LIMITATIONS} entries.`);
     }
     const unique = new Set();
     for (const item of value)
-        unique.add(requiredText(item, 240, `Finding ${index + 1} limitation`));
+        unique.add(requiredText(item, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, `Finding ${index + 1} limitation`));
     return [...unique];
 }
+/** Keep provenance and omissions visible within the existing import bound. */
+export function retainExternalFindingLimitations(supplied, mandatory) {
+    const required = limitations(mandatory, 0);
+    const optional = limitations(supplied, 0).filter((entry) => !required.includes(entry));
+    const available = MAX_EXTERNAL_FINDING_LIMITATIONS - required.length;
+    if (optional.length <= available)
+        return Object.freeze([...required, ...optional]);
+    if (available < 1)
+        throw new TypeError('Mandatory finding limitations leave no room to disclose omitted supplied limitations.');
+    const retained = optional.slice(0, available - 1);
+    const omitted = optional.length - retained.length;
+    return Object.freeze([
+        ...required,
+        ...retained,
+        `${omitted} supplied limitation${omitted === 1 ? ' was' : 's were'} omitted to retain mandatory provenance and omission notices; review the supplied input for the remaining qualifications.`,
+    ]);
+}
 function structuredObservation(value, index) {
     if (value === undefined || value === null)
         return null;
@@ -162,16 +183,7 @@ function structuredObservation(value, index) {
     };
 }
 function findingKey(finding, sourceName) {
-    return [
-        finding.domain,
-        finding.category,
-        finding.evidenceClass,
-        finding.summary,
-        finding.observedAt,
-        finding.completeness,
-        sourceName,
-        finding.structuredObservation?.eventId ?? '',
-    ].join('\u0000');
+    return canonicalArtifactJsonV2({ sourceName, finding });
 }
 export function parseExternalFindingsDocument(value) {
     const root = record(value);
@@ -267,21 +279,19 @@ function importedSourceLabel(finding, sourceName) {
         ? `Deployment observation: ${sourceName}`
         : `Provider report: ${sourceName}`;
 }
-function existingPinKey(recordValue, finding, sourceName) {
-    const expectedLabel = `External ${finding.category} finding`;
-    const expectedValue = finding.structuredObservation?.value ?? pinValue(finding);
-    const expectedSource = importedSourceLabel(finding, sourceName);
-    const observation = finding.structuredObservation;
-    return recordValue.evidencePins.some((pin) => (pin.label === expectedLabel
-        && pin.value === expectedValue
-        && pin.source === expectedSource
-        && pin.observedAt === finding.observedAt
-        && pin.completeness === finding.completeness
-        && (!observation || (pin.field === observation.field
-            && pin.sourceSchema?.collection === 'external_observations'
-            && pin.sourceSchema.schema === observation.sourceSchema
-            && pin.sourceSchema.version === observation.sourceVersion
-            && (observation.eventId === null || pin.certificateObservation?.eventId === observation.eventId))))) ? findingKey(finding, sourceName) : '';
+function alreadyRetained(recordValue, projection) {
+    const { importContentSha256: expectedIdentity, ...expected } = projection.evidencePin;
+    return recordValue.evidencePins.some((pin) => {
+        const { id: _id, createdAt: _createdAt, importContentSha256, ...material } = pin;
+        if (importContentSha256 && importContentSha256 !== expectedIdentity)
+            return false;
+        // Older pins have no content digest. Only a complete, exact retained
+        // projection can establish duplication; a shortened prefix cannot.
+        if (!importContentSha256 && (projection.shortenedFields.length || projection.omittedLimitations))
+            return false;
+        // An imported digest alone cannot substitute for matching retained fields.
+        return canonicalArtifactJsonV2(material) === canonicalArtifactJsonV2(expected);
+    });
 }
 function structuredPinFields(finding) {
     const observation = finding.structuredObservation;
@@ -313,37 +323,41 @@ function structuredPinFields(finding) {
         certificateObservation,
     };
 }
-function mergeExternalFindingIntoCase(current, caseId, finding, source, now) {
-    const target = current.find((candidate) => candidate.id === caseId) ?? null;
-    if (!target)
-        throw new Error('The selected Case is unavailable for this finding.');
-    if (existingPinKey(target, finding, source.name)) {
-        return { cases: [...current], record: target, added: false };
-    }
-    const sourceLimitations = [
+/** Exact material retained by both the import preview and Case mutation. */
+export function externalFindingCaseProjection(finding, source) {
+    const identitySha256 = sha256IdentityHex(new TextEncoder().encode(canonicalArtifactJsonV2({
+        sourceName: source.name, sourceReference: source.reference, finding,
+    })));
+    const value = finding.structuredObservation?.value ?? pinValue(finding);
+    const sourceLabel = importedSourceLabel(finding, source.name);
+    const sourceReference = source.reference ? `Source reference: ${source.reference}` : null;
+    const shortenedFields = [
+        ...(value.length > MAX_RESPONSE_VALUE_LENGTH ? ['finding value'] : []),
+        ...(sourceLabel.length > MAX_RESPONSE_LABEL_LENGTH ? ['source label'] : []),
+        ...(sourceReference && sourceReference.length > MAX_RESPONSE_LIMITATION_LENGTH ? ['source reference'] : []),
+    ];
+    const mandatory = [
         finding.evidenceClass === 'deployment_observation'
             ? `Imported as an observation made by ${source.name}; this browser session did not collect or independently verify it.`
             : `Reported by ${source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
-        ...(source.reference ? [`Source reference: ${source.reference}`] : []),
-        ...finding.limitations,
+        ...(sourceReference ? [sourceReference.length > MAX_RESPONSE_LIMITATION_LENGTH
+                ? `${sourceReference.slice(0, MAX_RESPONSE_LIMITATION_LENGTH - 13)}… [shortened]` : sourceReference] : []),
+        ...(shortenedFields.length ? [`Case storage shortened ${shortenedFields.join(', ')}. The content digest covers the complete accepted finding.`] : []),
     ];
-    const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
-    let updated = updateCase([...current], target.id, {
-        evidencePin: {
+    const sourceLimitations = retainExternalFindingLimitations(finding.limitations, mandatory);
+    const omittedLimitations = finding.limitations.filter((item) => !sourceLimitations.includes(item)).length;
+    const pin = normalizeCaseEvidencePins([{
             ...structuredPinFields(finding),
+            importContentSha256: identitySha256,
             label: `External ${finding.category} finding`,
-            value: finding.structuredObservation?.value ?? pinValue(finding),
-            source: importedSourceLabel(finding, source.name),
+            value,
+            source: sourceLabel,
             observedAt: finding.observedAt,
             completeness: finding.completeness,
+            truncated: shortenedFields.length || omittedLimitations ? true : null,
             limitations: sourceLimitations,
-        },
-    }, now);
-    const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
-    if (!addedPin)
-        throw new Error('The imported finding could not be retained as Case evidence.');
-    updated = updateCase(updated.cases, target.id, {
-        sighting: {
+        }], finding.observedAt)[0];
+    const observed = normalizeCaseSightings([{
             state: finding.evidenceClass === 'deployment_observation'
                 ? 'observed_by_deployment'
                 : 'reported_by_provider',
@@ -359,9 +373,28 @@ function mergeExternalFindingIntoCase(current, caseId, finding, source, now) {
             source: source.name,
             observedAt: finding.observedAt,
             completeness: finding.completeness,
-            evidencePinId: addedPin.id,
             limitations: sourceLimitations,
-        },
+        }], finding.observedAt)[0];
+    if (!pin || !observed)
+        throw new TypeError('The finding has no valid retained Case projection.');
+    const { id: _pinId, createdAt: _pinCreatedAt, ...evidencePin } = pin;
+    const { id: _sightingId, createdAt: _sightingCreatedAt, evidencePinId: _pinReference, ...sighting } = observed;
+    return { evidencePin, sighting, identitySha256, shortenedFields, omittedLimitations };
+}
+function mergeExternalFindingIntoCase(current, caseId, finding, source, now) {
+    const target = current.find((candidate) => candidate.id === caseId) ?? null;
+    if (!target)
+        throw new Error('The selected Case is unavailable for this finding.');
+    const projection = externalFindingCaseProjection(finding, source);
+    if (alreadyRetained(target, projection))
+        return { cases: [...current], record: target, added: false };
+    const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
+    let updated = updateCase([...current], target.id, { evidencePin: projection.evidencePin }, now);
+    const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
+    if (!addedPin)
+        throw new Error('The imported finding could not be retained as Case evidence.');
+    updated = updateCase(updated.cases, target.id, {
+        sighting: { ...projection.sighting, evidencePinId: addedPin.id },
     }, now);
     return { cases: updated.cases, record: updated.record, added: true };
 }
@@ -372,7 +405,6 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
     let findingsAdded = 0;
     let duplicatesSkipped = 0;
     for (const finding of document.findings) {
-        const existing = cases.find((candidate) => candidate.domain === finding.domain) ?? null;
         const opened = openOrCreateCase(cases, { domain: finding.domain, source: 'import' }, now);
         cases = opened.cases;
         const target = cases.find((candidate) => candidate.id === opened.record.id) ?? opened.record;
@@ -383,10 +415,10 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
             continue;
         }
         findingsAdded += 1;
-        if (existing)
-            updatedDomains.add(finding.domain);
-        else
+        if (opened.created)
             createdDomains.add(finding.domain);
+        else
+            updatedDomains.add(finding.domain);
     }
     return {
         cases,
@@ -422,7 +454,7 @@ export function externalFindingsCaseTargets(document, caseDomain) {
 }
 /**
  * Merges already-validated external findings into one selected Case. A Case is
- * keyed to its registrable domain, while rendered captures may retain an exact
+ * identified by its immutable ID with a registrable-domain pivot, while rendered captures may retain an exact
  * hostname. Only same-domain findings are accepted, the exact hostname remains
  * explicit in the retained evidence, and this operation can never open another
  * Case as a side effect.

package/packages/interchange/managed-indicator-export.mjs

@@ -0,0 +1,35 @@
+import { readManagedIndicatorSet } from "./managed-indicator-set.mjs";
+import { stixIndicatorObjects, stixIndicatorProducer } from "./stix-indicator-export.mjs";
+import { mispIndicatorAttribute, mispIndicatorEvent } from "./misp-indicator-export.mjs";
+/** Re-exporting a revision is deterministic; revoked object versions never advance. */
+export async function exportManagedIndicators(input, format) {
+    const manifest = await readManagedIndicatorSet(input);
+    let document = manifest;
+    if (format === 'stix') {
+        const producer = `identity--${manifest.producerId}`;
+        document = { type: 'bundle', id: `bundle--${manifest.revisionId}`, objects: [
+                stixIndicatorProducer(producer, manifest.createdAt),
+                ...manifest.entries.flatMap(entry => stixIndicatorObjects(entry.domain, entry.observation.availability, entry.observation, entry.createdAt, producer, type => `${type}--${entry.id}`)
+                    .map(object => object.type !== 'indicator' ? object : { ...object,
+                    modified: entry.modifiedAt, valid_until: entry.expiresAt, revoked: entry.withdrawal !== null,
+                    x_whoisleuth_managed_set: manifest.id, x_whoisleuth_original_review_basis: entry.basis,
+                    x_whoisleuth_review_basis: entry.reviewBasis,
+                    ...(entry.withdrawal ? { x_whoisleuth_withdrawal_reason: entry.withdrawal.reason } : {}),
+                })),
+            ] };
+    }
+    else if (format === 'misp') {
+        const attributes = manifest.entries.map(entry => {
+            const attribute = mispIndicatorAttribute(entry.domain, entry.observation.availability, entry.observation, entry.id, entry.modifiedAt);
+            return { ...attribute, deleted: entry.withdrawal !== null,
+                comment: `${attribute.comment}; review-expires=${entry.expiresAt}; expiry requires recipient review, not automatic deletion; original-basis=${entry.basis}; latest-review=${entry.reviewBasis}${entry.withdrawal ? `; withdrawn=${entry.withdrawal.reason}` : ''}` };
+        });
+        document = { Event: { ...mispIndicatorEvent(manifest.id, manifest.createdAt, attributes),
+                info: `${manifest.name} · reviewed domain indicators`, timestamp: String(Math.floor(Date.parse(manifest.modifiedAt) / 1000)) } };
+    }
+    else if (format !== 'manifest')
+        throw new TypeError('Unsupported managed indicator export format.');
+    return { document, content: `${JSON.stringify(document, null, 2)}\n`,
+        filename: `whoisleuth-indicators-${manifest.id}-r${manifest.revision}.${format}.json`,
+        mimeType: format === 'stix' ? 'application/stix+json;charset=utf-8' : 'application/json;charset=utf-8' };
+}